Windows Messenger

[Iturea]

Ok I have Norton Securities on my system. In the firewall log every 2 seconds, it gives the information:

An instance of "C:\Program Files\Messenger\msmsgs.exe" is preparing to access the Internet for the first time

Every 2 seconds!!!!! It is constant and never ends.

I have disabled every service I could think of without rendering my Windows XP useless.

I am running a semi private web server on my system. In other words it is not a public website. The domain is public through Whois and others, so a hacker from China tried to attack me yesterday morning but Norton blocked him. In addition, the attack he rendered was previously patched through a critical update on www.windowsupdate.com that I installed earlier.

Anyhow after the attack is when the messages started appearing.

An instance of "C:\Program Files\Messenger\msmsgs.exe" is preparing to access the Internet for the first time

Every 2 seconds!!!

I think there might be something screwed up on my system. Everything is working just fine though and my web server is still up and running. Msmsgs.exe is not actually accessing the internet because I have it (msmsgs.exe) fully blocked. There is no traffic going out from my computer except keep-alives and so forth (normal stuff). So has anyone seen this before? How do I fix it?

Please help!

[Steve R Jones]

Find the folder Messenger and rename it.

[Marvinator]

Have you Updated your VirusScan? Run a complete System Scan? do you own a spyware/adware program? if not get SpyBot and Adaware and run both.

The only service that is the problem is this errant Messanger Service. It does not seem to be part of anything else and could be spyware. You can disable it temporarily by going to Start - Run. Type msconfig, click OK. Go to the Start Up Tab, and find the offending exe in the list. UNCHECK the box and reboot. If somethign stops working correctly then you can assess the need for this service.

[Iturea]

I'll try those things - thanks

[Iturea]

Found a solution:

I didn’t have any foreign start up application pointers in my registry that needed deletion. I also didn’t have a virus or adware come to find out. I do however have a valid program somewhere on my system using Windows Messengers API’s to communicate with a remote system. Note: This could be a security breach - so I am eliminating the problem with the solution below...

Note: Simply removing the check mark in Add/Remove Windows components only takes the start menu links away – not the services and/or program.


http://support.microsoft.com/default...b;en-us;302089

Windows Messenger 4.0 or Later on a Windows XP Professional-Based Computer
Click Start, click Run, type gpedit.msc, and then press ENTER.
Double-click the following items to expand them:
Local Computer Policy
Computer Configuration
Administrative Templates
Windows Components
Windows Messenger
Double-click Do not allow Windows Messenger to run, and then click Enabled.
Click OK, and then quit the Group Policy snap-in.
NOTE: Group Policy Editor (Gpedit.msc) is not available on Windows XP Home Edition-based computers.

NOTE: This method also prevents programs that use the Messenger Application Programming Interfaces (APIs) from using Windows Messenger. Microsoft Outlook 2002, Microsoft Outlook Express 6, and the Remote Assistance feature in Windows XP are examples of programs that use these APIs and that depend on Windows Messenger.

[crystaldragon]

You might want to take a lookHere

[John Prophet]

run "services.msc"
turn off "messenger" (its not the same as msn messenger)

[DanGrease]

If I were you I would delete Windows Messenger and install MSN Messenger instead. Works better IMO, and its more modern.

dan